Contributed by jose on from the right-before-the-release! dept.
A bounds check that was added to lprm in 1996 does its checking too late to be effective. Because of the insufficient check, it may be possible for a local user to exploit lprm to gain elevated privileges. It is not know at this time whether or not the bug is actually exploitable.Patches for 3.1-stable are available ( patch 023 ) and 3.2-stable ( patch 010 ).
Starting with OpenBSD 3.2, lprm is setuid user daemon which limits the impact of the bug. OpenBSD 3.1 and below however, ship with lprm setuid root so this is a potential localhost root hole on older versions of OpenBSD.
The bug is fixed in OpenBSD-current as well as the 3.2 and 3.1 -stable branches.
Thanks go to Arne Woerner for noticing this bug.
(Comments are closed)